# 2026-08-19 security fix: trade screenshots must only ever be served
# through the ownership-checked GET /api/journal/view-screenshot endpoint
# (see src/ScreenshotStorage.php and api/journal/view-screenshot.php) —
# never as a direct static file. Before this, Apache served any file under
# public/uploads/ directly (see the app root .htaccess's own
# `RewriteCond %{REQUEST_FILENAME} !-f`), relying solely on the filename
# being unguessable, with no per-request check that the requester actually
# owned the trade the screenshot belonged to.
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
</IfModule>
